platform/src/Core/Framework/Api/Acl/AclAnnotationValidator.php line 34

Open in your IDE?
  1. <?php declare(strict_types=1);
  3. namespace Shopware\Core\Framework\Api\Acl;
  5. use Doctrine\DBAL\Connection;
  6. use Shopware\Core\Framework\Api\Exception\MissingPrivilegeException;
  7. use Shopware\Core\Framework\Routing\Annotation\Acl;
  8. use Shopware\Core\Framework\Routing\KernelListenerPriorities;
  9. use Shopware\Core\Framework\Uuid\Uuid;
  10. use Shopware\Core\PlatformRequest;
  11. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  12. use Symfony\Component\HttpFoundation\Request;
  13. use Symfony\Component\HttpKernel\Event\ControllerEvent;
  14. use Symfony\Component\HttpKernel\KernelEvents;
  16. class AclAnnotationValidator implements EventSubscriberInterface
  17. {
  18.     private Connection $connection;
  20.     public function __construct(Connection $connection)
  21.     {
  22.         $this->connection = $connection;
  23.     }
  25.     public static function getSubscribedEvents()
  26.     {
  27.         return [
  28.             KernelEvents::CONTROLLER => [
  29.                 ['validate', KernelListenerPriorities::KERNEL_CONTROLLER_EVENT_SCOPE_VALIDATE],
  30.             ],
  31.         ];
  32.     }
  34.     public function validate(ControllerEvent $event): void
  35.     {
  36.         $request = $event->getRequest();
  38.         $acl = $request->attributes->get('_acl');
  40.         if (!$acl || !($acl instanceof Acl)) {
  41.             return;
  42.         }
  44.         $privileges = $acl->getValue();
  46.         $context = $request->attributes->get(PlatformRequest::ATTRIBUTE_CONTEXT_OBJECT);
  47.         if ($context === null) {
  48.             throw new MissingPrivilegeException([]);
  49.         }
  51.         foreach ($privileges as $privilege) {
  52.             if ($privilege === 'app') {
  53.                 if ($context->isAllowed('app.all')) {
  54.                     return;
  55.                 }
  57.                 $privilege = $this->getAppPrivilege($request);
  58.             }
  60.             if (!$context->isAllowed($privilege)) {
  61.                 throw new MissingPrivilegeException([$privilege]);
  62.             }
  63.         }
  64.     }
  66.     private function getAppPrivilege(Request $request): string
  67.     {
  68.         $actionId = $request->get('id');
  70.         if (empty($actionId)) {
  71.             throw new MissingPrivilegeException();
  72.         }
  74.         $appName = $this->connection->fetchOne(
  75.             '
  76.                 SELECT `app`.`name` AS `name`
  77.                 FROM `app`
  78.                 INNER JOIN `app_action_button` ON `app`.`id` = `app_action_button`.`app_id`
  79.                 WHERE `app_action_button`.`id` = :id
  80.             ',
  81.             ['id' => Uuid::fromHexToBytes($actionId)],
  82.         );
  84.         return 'app.' . $appName;
  85.     }
  86. }